How to stop ingesting a field value

[franciscof]

Hi guys, I have an input made from the ASplunk addon for AWS and what I want to do is to stop ingesting a field value. This is cloudflare data and what I want to stop ingesting is the field value WAFAction=unknown

Could I do this through the props and transforms? If so, how should I do it?

Thanks in advance.

Regards,

[richgalloway]

So you want to not ingest the field WAFAction, but only if the value is "unknown", correct?  I'm curious about the use case for that.  You may be able to do it with INGEST_EVAL.  Here's an untested transform:

[dropunknownwafaction]
INGEST_EVAL = WAFAction:=if(WAFAction="unknown", null(), WAFAction)

[franciscof]

Actually is the other way around. I do not want to ingest that specific field value (WAFAction=unknown). How could I do?

[richgalloway]

That is why my answer does.  It only ingests the WAFAction field if the value is not "unknown".